Crash in CachedResource::checkNotify due to -webkit-crossfade.
https://bugs.webkit.org/show_bug.cgi?id=98068

Reviewed by Nate Chapin.

Source/WebCore:

Make sure to not re-add the same client again for |m_cachedFromImage|
and |m_cachedToImage|. This would otherwise cause the CSSCrossfadeValue
client to not get removed from its cached image resource (when it is
going away).

Test: fast/images/crossfade-client-not-removed-crash.html

* css/CSSCrossfadeValue.cpp:
(WebCore::CSSCrossfadeValue::loadSubimages):

LayoutTests:

* fast/images/crossfade-client-not-removed-crash-expected.txt: Added.
* fast/images/crossfade-client-not-removed-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136558 268f45cc-cd09-0410-ab3c-d52691b4dbfc
NodeFilter leaks memory in V8
https://bugs.webkit.org/show_bug.cgi?id=104027

Reviewed by Eric Seidel.

NodeFilter holds a RefPtr to NodeFilterCondition, which holds a
ScopedPersistent to its callback function. If the callback function can
see the NodeFilter wrapper, we have a cycle and a leak.

This patch makes the NodeFilterCondition hold a weak pointer to the
callback function and ties the lifetime of that callback function to
the NodeFilter wrapper (so they live and die together).

* bindings/v8/V8GCController.cpp:
* bindings/v8/V8NodeFilterCondition.cpp:
(WebCore::V8NodeFilterCondition::V8NodeFilterCondition):
(WebCore::V8NodeFilterCondition::weakCallback):
(WebCore):
(WebCore::V8NodeFilterCondition::acceptNode):
* bindings/v8/V8NodeFilterCondition.h:
(WebCore::V8NodeFilterCondition::create):
(V8NodeFilterCondition):
(WebCore::V8NodeFilterCondition::callback):
* dom/NodeFilter.h:
(WebCore::NodeFilter::condition):


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136559 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Heap-use-after-free in WebCore::StyleCachedImageSet::cssValue
https://bugs.webkit.org/show_bug.cgi?id=100621

Reviewed by Eric Seidel.

Source/WebCore:

r115639 fixed a memory leak caused by reference cycle between StyleCachedImageSet
and its owner CSSImageSetValue. The fix caused StyleCachedImageSet to maintain
a weak pointer to CSSImageSetValue. This patch makes sure that the weak pointer
is cleared when CSSImageSetValue is going away.

Test: fast/css/image-set-value-not-removed-crash.html

* css/CSSImageSetValue.cpp:
(WebCore::CSSImageSetValue::~CSSImageSetValue):
* rendering/style/StyleCachedImageSet.h:
(WebCore::StyleCachedImageSet::clearImageSetValue):
(StyleCachedImageSet):

LayoutTests:

* fast/css/image-set-value-not-removed-crash-expected.txt: Added.
* fast/css/image-set-value-not-removed-crash.html: Added.

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136560 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[User Timing] Fix negative durations
https://bugs.webkit.org/show_bug.cgi?id=104038

Reviewed by Tony Gentilcore.

At some point, we went from passing in a duration to passing in the end time. User Timing
wasn't updated.

Tests: http/tests/w3c/webperf/submission/Intel/user-timing

* page/PerformanceMark.h:
(WebCore::PerformanceMark::PerformanceMark):
* page/PerformanceUserTiming.cpp:
(WebCore::UserTiming::measure):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136561 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed.  Rolled DEPS.

* DEPS:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136562 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Web Inspector: NMI introduce heap graph recording API
https://bugs.webkit.org/show_bug.cgi?id=103232

Reviewed by Vsevolod Vlasov.

MemoryInstrumentationClient is extended with several methods for reporting
heap graph vertices and edges. Edge source is always idenfied by heap object
address. Target node might be either a destination object address(either real
or adjusted if the edge was retrieved from a pointer to a base class) or a
MemoryObjectInfo in case of internal buffers.

* wtf/MemoryInstrumentation.cpp:
(WTF::MemoryInstrumentation::reportEdge):
(WTF):
(WTF::MemoryInstrumentation::reportLinkToBuffer): report edge between the object
and a buffer which it owns.
(WTF::MemoryInstrumentation::InstrumentedPointerBase::process):
(WTF::MemoryClassInfo::addRawBuffer):
(WTF::MemoryClassInfo::addPrivateBuffer):
* wtf/MemoryInstrumentation.h:
(MemoryInstrumentationClient):
(WTF::MemoryInstrumentationClient::reportNode):
(WTF::MemoryInstrumentationClient::reportEdge):
(WTF::MemoryInstrumentationClient::reportLeaf):
(WTF::MemoryInstrumentationClient::reportBaseAddress): if we found an object by a pointer
to base class it may have different value than real object address. Report both real and
adjusted addresses so that they both can be used for identifying corresponding heap graph
node.
(WTF::MemoryInstrumentation::addRootObject):
(MemoryInstrumentation):
(WTF::MemoryInstrumentation::addObject):
(WTF::MemoryInstrumentation::addRawBuffer):
(WTF::MemoryInstrumentation::OwningTraits::addObject):
(WTF::MemoryClassInfo::addMember):
(MemoryClassInfo):
(WTF::MemoryInstrumentation::addObjectImpl):
* wtf/MemoryObjectInfo.h: added methods for repoting class name and some name string.
(WTF::MemoryObjectInfo::setClassName):
(WTF::MemoryObjectInfo::setName):
(MemoryObjectInfo):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136563 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed chromium expectations update.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136564 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[User Timing] Fix clang build by removing need for exit time destructor
https://bugs.webkit.org/show_bug.cgi?id=104036

Reviewed by Tony Gentilcore.

Modeled after r99588.

No new tests. No change in functionality.

* page/PerformanceUserTiming.cpp:
(WebCore::UserTiming::UserTiming):
(WebCore::UserTiming::mark):
(WebCore::UserTiming::findExistingMarkStartTime):
* page/PerformanceUserTiming.h:
(UserTiming):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136565 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Set the visible process name before entering the sandbox
https://bugs.webkit.org/show_bug.cgi?id=104030
<rdar://problem/12800317>

Reviewed by Sam Weinig.

Pass the UI process name along as a process initialization parameter so we can set it
before entering the sandbox. Remove the UI process name from WebProcessCreationParameters.

* Shared/WebProcessCreationParameters.cpp:
(WebKit::WebProcessCreationParameters::encode):
(WebKit::WebProcessCreationParameters::decode):
* Shared/WebProcessCreationParameters.h:
(WebProcessCreationParameters):
* UIProcess/Launcher/mac/ProcessLauncherMac.mm:
(WebKit::connectToWebProcessServiceForWebKitDevelopment):
(WebKit::createWebProcessService):
(WebKit::createProcess):
* UIProcess/mac/WebContextMac.mm:
(WebKit::WebContext::platformInitializeWebProcess):
* WebProcess/mac/WebProcessInitialization.h:
(WebProcessInitializationParameters):
* WebProcess/mac/WebProcessInitialization.mm:
(WebKit::initializeWebProcess):
* WebProcess/mac/WebProcessMac.mm:
(WebKit::WebProcess::platformInitializeWebProcess):
* WebProcess/mac/WebProcessMainMac.mm:
(WebKit::WebProcessMain):
* WebProcess/mac/WebProcessServiceEntryPoints.h:
* WebProcess/mac/WebProcessServiceEntryPoints.mm:
(WebKit::WebProcessServiceEventHandler):
(initializeWebProcessForWebProcessServiceForWebKitDevelopment):
* WebProcessServiceForWebKitDevelopment/WebProcessServiceForWebKitDevelopmentMain.mm:
(WebProcessServiceForWebKitDevelopmentEventHandler):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136568 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed chromium rebaselines.

* platform/chromium-mac-snowleopard/fast/parser/document-write-ignores-later-network-bytes-expected.png: Added.
* platform/chromium-mac-snowleopard/fast/parser/document-write-ignores-later-network-bytes-expected.txt: Added.


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136569 268f45cc-cd09-0410-ab3c-d52691b4dbfc
[chromium] Layout test inspector-protocol/debugger-pause-dedicated-worker.html is flaky
https://bugs.webkit.org/show_bug.cgi?id=101229

Reviewed by Vsevolod Vlasov.

Removed unnecessary logging that introduced flakiness to the tests.

* inspector-protocol/debugger-pause-dedicated-worker-expected.txt:
* inspector-protocol/debugger-pause-dedicated-worker.html:
* inspector-protocol/debugger-terminate-dedicated-worker-while-paused-expected.txt:
* inspector-protocol/debugger-terminate-dedicated-worker-while-paused.html:
* platform/chromium/TestExpectations:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136571 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Rename Profiler to LegacyProfiler
https://bugs.webkit.org/show_bug.cgi?id=104031

Rubber stamped by Mark Hahnenberg

Source/JavaScriptCore: 

Make room in the namespace for https://bugs.webkit.org/show_bug.cgi?id=102999.

* API/JSProfilerPrivate.cpp:
(JSStartProfiling):
(JSEndProfiling):
* CMakeLists.txt:
* GNUmakefile.list.am:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
* JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
* JavaScriptCore.xcodeproj/project.pbxproj:
* Target.pri:
* interpreter/Interpreter.cpp:
(JSC::Interpreter::throwException):
(JSC::Interpreter::execute):
(JSC::Interpreter::executeCall):
(JSC::Interpreter::executeConstruct):
* jit/JIT.h:
* jit/JITCode.h:
* jit/JITStubs.cpp:
(JSC::DEFINE_STUB_FUNCTION):
* jit/JITStubs.h:
(JSC):
* llint/LLIntSlowPaths.cpp:
(JSC::LLInt::LLINT_SLOW_PATH_DECL):
* profiler/LegacyProfiler.cpp: Added.
(JSC):
(JSC::LegacyProfiler::profiler):
(JSC::LegacyProfiler::startProfiling):
(JSC::LegacyProfiler::stopProfiling):
(JSC::dispatchFunctionToProfiles):
(JSC::LegacyProfiler::willExecute):
(JSC::LegacyProfiler::didExecute):
(JSC::LegacyProfiler::exceptionUnwind):
(JSC::LegacyProfiler::createCallIdentifier):
(JSC::createCallIdentifierFromFunctionImp):
* profiler/LegacyProfiler.h: Added.
(JSC):
(LegacyProfiler):
(JSC::LegacyProfiler::currentProfiles):
* profiler/ProfileGenerator.cpp:
(JSC::ProfileGenerator::addParentForConsoleStart):
* profiler/ProfileNode.cpp:
* profiler/Profiler.cpp: Removed.
* profiler/Profiler.h: Removed.
* runtime/JSGlobalData.h:
(JSC):
(JSC::JSGlobalData::enabledProfiler):
(JSGlobalData):
* runtime/JSGlobalObject.cpp:
(JSC::JSGlobalObject::~JSGlobalObject):

Source/WebCore: 

Just renaming, no new tests.

* ForwardingHeaders/profiler/LegacyProfiler.h: Copied from Source/WebCore/ForwardingHeaders/profiler/Profiler.h.
* ForwardingHeaders/profiler/Profiler.h: Removed.
* bindings/js/ScriptProfiler.cpp:
(WebCore::ScriptProfiler::start):
(WebCore::ScriptProfiler::stop):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136572 268f45cc-cd09-0410-ab3c-d52691b4dbfc
createRareData should return a PassOwnPtr
https://bugs.webkit.org/show_bug.cgi?id=103851

Patch by Elliott Sprehn <esprehn@chromium.org> on 2012-12-04
Reviewed by Eric Seidel.

createRareData should return a PassOwnPtr, not an OwnPtr since it's
transfering ownership.

* dom/Element.cpp:
(WebCore::Element::createRareData):
* dom/Element.h:
(Element):
* dom/Node.cpp:
(WebCore::Node::createRareData):
* dom/Node.h:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136573 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Automatically handle suspend and resume of post attach callbacks
https://bugs.webkit.org/show_bug.cgi?id=103910

Patch by Elliott Sprehn <esprehn@chromium.org> on 2012-12-04
Reviewed by Eric Seidel.

Use RAII to handle suspend and resume of post attach callbacks since
they should always be called in pairs.

No new tests, just refactoring.

* dom/ContainerNode.h:
(PostAttachCallbackDisabler):
(WebCore::PostAttachCallbackDisabler::PostAttachCallbackDisabler):
(WebCore::PostAttachCallbackDisabler::~PostAttachCallbackDisabler):
(ContainerNode):
* dom/Document.cpp:
(WebCore::Document::recalcStyle):
* dom/Element.cpp:
(WebCore::Element::attach):
* html/HTMLFormControlElement.cpp:
(WebCore::HTMLFormControlElement::attach):
* html/HTMLInputElement.cpp:
(WebCore::HTMLInputElement::attach):
* html/HTMLPlugInImageElement.cpp:
(WebCore::HTMLPlugInImageElement::attach):
(WebCore):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136574 268f45cc-cd09-0410-ab3c-d52691b4dbfc
setIsInTopLayer is not really a setter
https://bugs.webkit.org/show_bug.cgi?id=103912

Patch by Elliott Sprehn <esprehn@chromium.org> on 2012-12-04
Reviewed by Eric Seidel.

Element::setInTopLayer isn't just a setter, it also adds the element
to the top layer vector in the document which changes it's display and
causes a reattach.

To make this more obvious make HTMLDialogElement use the methods on
Document and make those update the state boolean.

There also doesn't seem to be any reason for setInTopLayer
or isInTopLayer to be virtual, it appears it was a typo.

No new tests, just refactoring.

* dom/Document.cpp:
(WebCore::Document::addToTopLayer):
(WebCore::Document::removeFromTopLayer):
* dom/Element.cpp:
(WebCore::Element::setIsInTopLayer):
* dom/Element.h:
* html/HTMLDialogElement.cpp:
(WebCore::HTMLDialogElement::close):
(WebCore::HTMLDialogElement::showModal):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136575 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Unreviewed, mark css3/filters/effect-reference-hw.html as failing rather than crashing.

* platform/chromium/TestExpectations:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136576 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Simplify ShadowRoot::cloneNode(bool,ExceptionCode)
https://bugs.webkit.org/show_bug.cgi?id=103928

Patch by Elliott Sprehn <esprehn@gmail.com> on 2012-12-04
Reviewed by Dimitri Glazkov.

ShadowRoot can never be cloned and ShadowRoot::cloneNode(bool) always
returns null so there's no reason to have code in the cloneNode method
for script that acts as if it may not return null.

* dom/ShadowRoot.cpp:
(WebCore::ShadowRoot::cloneNode):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136577 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Properly create the header links in the code review tool
https://bugs.webkit.org/show_bug.cgi?id=104037

Reviewed by Adam Barth.

Right now, we just prepend "header" to the two existing links and change
the first link to point to the header. The problem is that jQuery's prepend
method just prepends to each item in the jQuery object instead of adding
the item to the beginning of the list as this code assumed.

* code-review-test.html:
* code-review.js:

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136578 268f45cc-cd09-0410-ab3c-d52691b4dbfc
nrwt: derive per-thread, per-worker stats from result summaries
https://bugs.webkit.org/show_bug.cgi?id=103943

Reviewed by Ojan Vafai.

This patch changes the manager and printing code to pull more
information from the ResultSummary object rather than tracking
additional statistics on the side. This allows us to consolidate
a bunch of logic and remove a bunch of free-floating lists and dicts of
of values. We add the shard_name and worker_name to each TestResult,
and then modify print_timing_statistics() and upload_json_files()
to just need the result summaries.

Note that this patch also changes the timing statistics slightly
so that the individual test times are the times to run just the
tests themselves (TestResult.test_run_time) and do not include the
times taken to run the ref tests, compute diffs, etc. The aggregated
per-worker and per-shard statistics still use the total time to
process each test (TestResult.total_run_time).

* Scripts/webkitpy/layout_tests/controllers/layout_test_runner.py:
(LayoutTestRunner.__init__):
(LayoutTestRunner.run_tests):
(LayoutTestRunner._handle_finished_test_list):
(LayoutTestRunner._handle_finished_test):
(Worker.handle):
(Worker._run_test):
* Scripts/webkitpy/layout_tests/controllers/manager.py:
(summarize_results):
(Manager.run):
(Manager._upload_json_files):
* Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
(ResultSummaryTest.summarized_results):
* Scripts/webkitpy/layout_tests/layout_package/json_layout_results_generator.py:
(JSONLayoutResultsGenerator.__init__):
(JSONLayoutResultsGenerator._get_test_timing):
* Scripts/webkitpy/layout_tests/models/test_results.py:
(TestResult.__init__):
* Scripts/webkitpy/layout_tests/views/printing.py:
(Printer.print_results):
(Printer._print_timing_statistics):
(Printer):
(Printer._print_worker_statistics):
(Printer._print_aggregate_test_statistics):
(Printer._print_individual_test_times):
(Printer._print_directory_timings):
* Scripts/webkitpy/layout_tests/views/printing_unittest.py:
(Testprinter.test_print_unexpected_results.get_unexpected_results):
(Testprinter):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136579 268f45cc-cd09-0410-ab3c-d52691b4dbfc
nrwt: result summaries should not require a list of tests to skip
https://bugs.webkit.org/show_bug.cgi?id=103951

Reviewed by Ryosuke Niwa.

We shouldn't really be passing a list of tests to skip to the
ResultSummary objects; they should be handled like any other
test result as much as possible.

* Scripts/webkitpy/layout_tests/controllers/layout_test_runner_unittest.py:
(LayoutTestRunnerTests._result_summary):
(LayoutTestRunnerTests.test_update_summary_with_result):
* Scripts/webkitpy/layout_tests/controllers/manager.py:
(Manager._prepare_lists):
(Manager.run):
* Scripts/webkitpy/layout_tests/controllers/manager_unittest.py:
(ManagerTest.test_look_for_new_crash_logs):
(ResultSummaryTest.get_result_summary):
* Scripts/webkitpy/layout_tests/models/result_summary.py:
(ResultSummary.__init__):
* Scripts/webkitpy/layout_tests/models/test_expectations.py:
(TestExpectations):
* Scripts/webkitpy/layout_tests/views/printing_unittest.py:
(Testprinter.get_result_summary):

git-svn-id: http://svn.webkit.org/repository/webkit/trunk@136580 268f45cc-cd09-0410-ab3c-d52691b4dbfc